[MEDIUM] Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

PKSA-yvdd-fpv6-9ncp CVE-2026-61449 GHSA-8h9x-89f2-m7x3

Affected package: getgrav/grav

Affected version: =2.0.1

Reported by:
GitHub